Vulnerability · Published Mar 18, 2024 · Assigned by vmware
CVE-2024-22257
High 8.2
In plain English
A high-severity missing authorization in Spring Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior to 6.2.3, an application is possible vulnerable to broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | 5.7.12 | GHSA-f3jh-qvm4-mg39 |
| Maven | org.springframework.security:spring-security-core | 5.8.11 | GHSA-f3jh-qvm4-mg39 |
| Maven | org.springframework.security:spring-security-core | 6.1.8 | GHSA-f3jh-qvm4-mg39 |
| Maven | org.springframework.security:spring-security-core | 6.2.3 | GHSA-f3jh-qvm4-mg39 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| N/A | Spring Security | 6.2.0 to 6.2.2, 6.1.0 to 6.1.7, 6.0.0 to 6.0.9, 5.8.0 to 5.8.10, 5.7.0 to 5.7.11 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N